Advanced local-network threat response
View Patent ↗There are provided measures for enabling advanced local-network threat response. Such measures could exemplarily comprise receiving, at a local-network honeypot entity, a username/password related authentication data in relation to a login attempt to the honeypot entity, triggering a threat response operation at a local-network backend entity upon detection of the username/password related authentication data, the threat response operation comprising testing validity of the username/password related authentication data in one or more local accounts of the local-network, and in case the username/password related authentication data is detected to be valid for any account in the local-network, determining that said account is compromised and locking the compromised account.
1. A method of local-network threat response, the method comprising:
receiving, at a local-network honeypot entity, a username/password related authentication data in relation to a login attempt to the honeypot entity, the username/password related authentication data being invalid for the honeypot entity but being valid for an account;
triggering a threat response operation at a local-network backend entity upon detection of the username/password related authentication data by the local-network honeypot entity, the threat response operation occurring prior to a further login attempt using the username/password related authentication data and comprising testing validity of the username/password related authentication data in one or more local accounts of the local-network; and
in response to determining that the username/password related authentication data is valid for the account in the local-network on the basis of testing, determining that said account is compromised and locking the compromised account.
2. The method according to claim 1 , wherein the username/password related authentication data comprises any of: username/password credentials, a password hash, a Kerberos ticket.
3. The method according to claim 1 , further comprising: storing the username/password related authentication data received from any login attempts at the local-network honeypot entity for further use by the threat response operation.
4. The method according to claim 1 , said threat response operation comprising one or more of: testing validity of the username/password related authentication data against active directory or other authentication resource of the local-network; verifying validity of the username/password related authentication data on basis of a maintained list of username/password related authentication data used in the local accounts of the local-network.
5. The method according to claim 1 , said threat response operation further comprising: making login attempts on one or more local accounts of the local-network by using the received username/password related authentication data and in case the login attempt is successful, determining that said local account is compromised.
6. The method according to claim 1 , said triggering further comprising: transferring information on the IP address of the local-network host initiating the login attempt from the local-network honeypot entity to the local-network backend entity.
7. The method according to claim 1 , further comprising, at an endpoint threat management system: blocking or isolating the local-network host on local-network level, and/or blocking or isolating at least one process of the local-network host relating to the detected compromise.
8. An apparatus, comprising a memory configured to store computer program code, and a processor configured to read and execute computer program code stored in the memory, wherein the processor is configured to cause the apparatus to perform:
receiving, at a local-network honeypot entity, a username/password related authentication data in relation to a login attempt to the honeypot entity, the username/password related authentication data being invalid for the honeypot entity but being valid for an account;
triggering a threat response operation at a local-network backend entity upon detection of the username/password related authentication data by the local-network honeypot entity, the threat response operation occurring prior to a further login attempt using the username/password related authentication data and comprising testing validity of the username/password related authentication data in one or more local accounts of the local-network; and
in response to determining that the username/password related authentication data is valid for the account in the local-network on the basis of testing, determining that said account is compromised and locking the compromised account.
9. The apparatus according to claim 8 , wherein the processor is configured to cause the apparatus to perform: storing the username/password related authentication data received from any login attempts at the local-network honeypot entity for further use by the threat response operation.
10. The apparatus according to claim 8 , wherein the processor is configured to cause the apparatus to perform said threat response operation by one or more of: testing validity of the username/password related authentication data against active directory or other authentication resource of the local-network; verifying validity of the username/password related authentication data on basis of a maintained list of username/password related authentication data used in the local accounts of the local-network.
11. The apparatus according to claim 8 , wherein the processor is configured to cause the apparatus to perform said threat response operation by: making login attempts on one or more local accounts of the local-network by using the received username/password related authentication data and in case the login attempt is successful, determining that said local account is compromised.
12. The apparatus according to claim 8 , wherein the processor is configured to cause the apparatus to perform: blocking or isolating the local-network host on local-network level, and/or blocking or isolating at least one process of the local-network host relating to the detected compromise.
13. A non-transitory computer storage medium having stored thereon computer program code which when executed by a processor, causes the processor to execute a method of local-network threat response, the method comprising:
receiving, at a local-network honeypot entity, a username/password related authentication data in relation to a login attempt to the honeypot entity, the username/password related authentication data being invalid for the honeypot entity but being valid for an account;
triggering a threat response operation at a local-network backend entity upon detection of the username/password related authentication data by the local-network honeypot entity, the threat response operation occurring prior to a further login attempt using the username/password related authentication data and comprising testing validity of the username/password related authentication data in one or more local accounts of the local-network; and
in response to determining that the username/password related authentication data is valid for the account in the local-network on the basis of testing, determining that said account is compromised and locking the compromised account.